EU Cyber Resilience Act timeline: what applies now and what comes in December 2027

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) did not switch on all at once. Its obligations start on different dates, and the first set of duties for manufacturers is already live. If you place software or connected products on the EU market, it helps to know which duties apply today and which ones you still have time to prepare for.

The key dates

• 10 December 2024: the regulation entered into force.
• 11 June 2026: the provisions on notified conformity assessment bodies started to apply.
• 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe security incidents.
• 11 December 2027: the remaining obligations apply, including the essential cybersecurity requirements, technical documentation and conformity assessment.

What applies now: reporting

Since 11 September 2026, a manufacturer that becomes aware of an actively exploited vulnerability in its product, or a severe incident affecting the security of the product, has to report it. The process has three steps.

• An early warning without undue delay, and in any case within 24 hours of becoming aware.
• A vulnerability notification (or incident notification) within 72 hours, with more detail on the issue and any mitigation.
• A final report: within 14 days after a fix or mitigation is available for a vulnerability, or within one month of the incident notification for a severe incident.

Reports go to the CSIRT designated as coordinator in the member state where the manufacturer has its main establishment, and to ENISA, through a single reporting platform. The practical point is that you need to know, today, who in your organisation detects, triages and files such a report, and how they reach that platform.

What comes in December 2027

From 11 December 2027, products with digital elements placed on the EU market must meet the essential cybersecurity requirements in Annex I. These cover security by design and by default, vulnerability handling over the support period, and security updates.

Manufacturers also have to produce technical documentation and carry out a conformity assessment appropriate to the product's category, then mark the product with the CE marking. Most products fall in the default category and can use a self-assessment. Products in the 'important' and 'critical' classes face stricter routes.

The SBOM requirement

Annex I requires manufacturers to identify and document the components in the product, including by drawing up a software bill of materials (SBOM) in a commonly used, machine-readable format that covers at least the top-level dependencies. The SBOM is part of the technical documentation. It does not have to be published, but authorities can ask for it.

Penalties

Failing to meet the essential requirements or the reporting duties can lead to administrative fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Other breaches carry lower caps, and market surveillance authorities can also order corrective action or withdraw a product.

A practical sequence for vendors

• Now: name an owner for vulnerability handling, write the internal procedure for the 24-hour and 72-hour reports, and publish a vulnerability disclosure policy with a contact address.
• Next: inventory your products, decide which are in scope and which category each falls into, and generate an SBOM for each.
• Through 2027: close the gaps against Annex I, build the technical documentation, and plan the conformity assessment route.

This article is general information, not legal advice. Check the regulation text and your own counsel for decisions about your specific products. Our tool, CRA Toolkit, helps teams work through scope, requirements and documentation, with answers that point back to the regulation.